Evidence analysis, preparation.
The first responder needs to prepare and
check several prerequisites, the availability of tools, reporting
requirement, and legal clearances in order to conduct a successful investigation.
As part of the analysis, first responders
will need to understand the investigation requirement scenario, check with lawyers
or organization for any specific analysis requirements, have a copy of the
organization's forensic investigation policy, take care to transport the
evidence to a secure location or forensic investigation lab, check the lab
facilities before starting the analysis, and prepare the evidence analysis toolkit
containing imaging, recovery, and analysis tools.
Some examples of forensic analysis tools.
Again, you're going to be playing with these in the lab.
I showed you a couple of examples throughout the module.
You got several more examples in the lab.
The volatility framework is the reference standard for analyzing memory dumps.
You're going to create a memory dump, you're going to run volatility against it,
and then you actually will run individual system commands against the memory dump.
Allows you to analyze RAM contents as if you were sitting on a live system
interacting with it, but allows you to do it after the fact.
So for example...
All right, so things like net user shows me my users on a system.
Okay, net stat shows me active connections, net file
shows me any files that are currently open from other sources.
Net Sessions shows me inactive sessions.
Ps list shows me running processes, Task list also shows me running processes.
This is all volatile information against a live system.
I'm doing that interactively, I'm getting the responses back immediately.
List DLLs.
These are all things you would do in a live system response.
Date time t date t, collecting system time and date.
All this stuff is done in real time, but what am I doing right now?
I'm interacting with a live system.
Actually, I'm leaving a footprint on the
live system because I'm interacting with it, I'm changing command history.
You get the idea.
If I was to do a memory dump of this
system and after the fact, ran volatility and specified all these system commands as
part of the volatility syntax, then I'm not interacting with the live system.
But it's slow because it has to parse the
whole memory dump to actually acquire this stuff.
Right now, it's live in memory.
And memory is by far and away the fastest
storage mechanism we have, way faster than a hard disk.
So you're going to see some latency when
you run each command, and you're going to be doing that in the lab.
That's the reason for the latency.
It has to parse the whole memory dump and
actually retreat it to actually retrieve the information.
But you can do a lot of the same types
of analyzes against a post mortem dump as you can a live system, which is just cool.
All right, the SleuthKitter autopsy.
Yeah, you're going to do a few labs or lab
exercise on the Sleuth Kit, which again is really multifaceted.
And again, you can come back for CHFI for the full discussion of all this.
But it sorts everything for you.
Web histories, web downloads, web cookies, bookmarks, shell bags, recent documents,
sorts all this stuff out for you, which is really cool.
It's a very multifaceted forensic analysis utility, and you're going to be walking
through timelines, file discovery, report generation as part of the web.
Forensic Explore.
I haven't really used it much, to be honest with you.
The Forensics Toolkit, plenty.
That's again, one of the reference standards out there.
Access Data. You've got Guidance Software's End Case,
which is probably the most widely used on the planet.
Ftk is probably a close second.
Then you get into your Autopsies and a bunch of other tools.
Mac tools sometimes are very dedicated, third party, but you do a lot
of the same analyzes because Mac FileS ystem is basically a Linux FileS ystem.
A lot of these tools will accommodate Mac as well.
But when you get into Mac specifically,
there's a lot of specialized tools for Mac forensics.
All right, Helix. Love Helix.
Helix has been around for an offy long time.
It's really cool because it's a Win 32 application and a bootable OS.
When you run Helix, you can actually run it within the Windows environment as a Win
32 application, or you can boot to it and it gives you a full desktop, Linux
desktop, RAM drive based runtime environment just like Kine.
Really cool.
A lot of cool utilities built into Helix as well.
All right, so again, that is probably one
of the most broad modules we've had yet, the most to talk about.
And again, the course that digs even
deeper into that is the CHFI, which is one of the courses I teach an awful lot.
I'd love to have you back for CHFI.
So more on that story.
We got a five day version of the course.
And again, we've got a bunch of different courses that map to all this content.
This is a great conglomeration of topics of discussion from multiple EC
Council course catalogs, specifically certified network defender, EC Council,
certified incident handler, CHFI, a forensics investigator, CEH for
sure, Ethical Hacker, Ethical Hacker Core of Skills, and CPET just to name a few.
All right, so that's going to wrap up Module 20, computer forensics.
And that completes our discussion of incident response as well.